Wideband Radio Frequency (RF) applications have been developed that are capable of accurate distance measurement between two or more wireless devices. These measurements are based on Time-of-Flight (ToF) calculations which are derived by accurate determination of departure and arrival times of RF packets between two devices. RF packets travel at the speed of light and thus a calculated ToF allows determination of the distance between devices. Such a procedure is commonly called ‘Ranging’. One practical application of Ranging is ‘Distance Bounding’ whereby ToF calculations are used to verify whether the distance between two devices is less than a predefined threshold, such as used for automotive Passive Keyless Entry (PKE) systems and other access control systems, as well as for contactless electronic payment systems.
A receiving device is able to derive a channel estimate in relation to a transmitting device using known patterns within a received packet from the transmitting device. For example, in IR-UWB (Impulse Radio-Ultra-WideBand) systems, such as defined in IEEE 802.15.4, a preamble comprising repeating synchronization symbols and a Start-of-Frame Delimiter (SFD) is placed in front of a payload segment. In IR-UWB receivers, the repeating synchronization symbols within the preamble of a received packet are typically used to realise time and frequency synchronization and to derive a channel estimate for the received packet. A channel estimate consists of an estimate of arrival times of multipath components, the first arrived multipath component represents the shortest radio path and is therefore important for the ToF calculations.
Significantly, since the synchronisation symbols are in many cases used for deriving the channel estimate within a receiving device, an attacking device only requires knowledge of the synchronisation symbol pattern and symbol period to employ an attack that influences the channel estimation process and therefore the ToF calculations.